A GitHub-native electronic Quality Management System baseline. Fork it, tailor it to your organisation, validate it, and run it, entirely in Git.
The baseline uses GitHub as the canonical system of record. Every controlled document, every approval, every audit trail entry lives in Git, not in a separate SaaS.
An adopting company mirrors the public baseline into a private repository, tailors it, validates it for intended use, and operates from there. Product files, supplier records, and validation evidence belong in the adopter's own repos, as this baseline provides the framework.
A bootstrap script sets up that private repository for you: it derives code-owner review from your signer registry and copies the baseline's branch protection and merge rules, so the controlled-review boundary is enforced from day one.
Every adopter operates the same product-independent core baseline. Optional adoption profiles answer the question "I am building X — which parts apply to me?" by layering the relevant SOPs, gap analyses, and record families on top of that core:
| Scenario | You are building | Standards layered on the core (ISO 9001) baseline |
|---|---|---|
| AI-based diagnostic software | Software with a medical purpose (diagnosis, screening, triage, decision support) that embeds AI/ML and qualifies as a medical device (SaMD + AI) | ISO 13485, ISO 14971, IEC 62304, IEC 62366-1, IEC 82304-1, ISO/IEC 42001, ISO/IEC 27001, GDPR / Swiss nFADP |
| App with AI features | A general software product that embeds AI/ML features but makes no medical claim and is not a medical device | ISO/IEC 42001, ISO/IEC 27001, GDPR / Swiss nFADP |
| Digital health app | A consumer or professional wellness app that processes health-adjacent data but is not a medical device | ISO/IEC 27001, IEC 82304-1 (good practice), GDPR / Swiss nFADP |
| In-house clinical software | Software built inside a clinic or hospital for its own patients, not placed on the market | ISO 14971, IEC 62304 (tailored), IEC 62366-1, ISO/IEC 27001, GDPR / Swiss nFADP |
| Clinical-study support software | Computerized systems used in clinical research (data capture, study management, ePRO) | ISO/IEC 27001, GDPR / Swiss nFADP, plus the opt-in GAMP 5 / 21 CFR Part 11 / EU Annex 11 overlay |
For clinical-research contexts, an opt-in GxP overlay maps the baseline against GAMP 5, 21 CFR Part 11, and EU Annex 11 expectations — showing which existing controls you can reuse and what you must add yourself. Profiles are optional adoption aids, not regulatory advice; see the adoption guide.
GitHub authenticates users through its own identity provider, but FDA 21 CFR Part 11 requires that each electronic signature reflects a deliberate, attributable act of signing, not just a code review approval.
The Signature Worker closes that gap. It is a Cloudflare Worker that intercepts the approval event and requires a secondary, time-limited PIN code before recording the signature. The result is a cryptographically bound record that ties the signer's identity, intent, timestamp, and the exact document revision into a single verifiable artefact attached to the GitHub Release.
The current published DearAuditor Open QMS Baseline (QMS-2026-07-09-R005) contains:
Alongside the eQMS baseline, dearauditor.ch provides a dedicated auditing application. It lets Regulatory Affairs professionals upload technical documentation, run AI-assisted verification against requirements such as Swiss MedDO/MDR, and produce structured audit reports locally, with no cloud storage of documents.
Roadmap: We are building pre-submission checklists for Notified Bodies so that your technical file can be automatically cross-checked with the dearauditor.ch toolset before you submit.
The open-source baseline gives you the framework. But installing it in a regulated company means validating the platform, the workflows, and the signature infrastructure against your specific risk profile and intended use.
We maintain a private validation capability that produces formal IQ/OQ/PQ documentation packages, including GitHub platform supplier qualification, signature worker validation, and workflow-level risk assessments, all tailored to your organisational context.
Need validation documentation? Reach out and we will scope a package for your installation.
Yes. The DearAuditor Open eQMS baseline uses GitHub as the canonical system of record: Issues drive planning and intake (CAPA, audits, risk items, training), Pull Requests form the controlled review and approval boundary, Actions enforce policy and signature collection, and Releases publish immutable versioned quality records. An adopting company mirrors the public baseline into a private repository, tailors it, and validates it for its intended use.
The baseline ships gap analyses and controls for ISO 9001, ISO 13485, ISO 14971, IEC 62304, IEC 62366-1, IEC 82304-1, ISO/IEC 27001, ISO/IEC 42001, GDPR, and the Swiss nFADP, plus an optional GAMP 5 / GxP overlay covering 21 CFR Part 11 and EU Annex 11 expectations for clinical-research contexts.
No QMS is compliant out of the box. The baseline provides the framework: a Quality Manual, 23 SOPs, work instructions, gap analyses, record templates, and workflow automation. Certification and compliance are properties of the adopting company's tailored, validated installation, not of the upstream open-source baseline itself.
A dedicated Signature Worker (a Cloudflare Worker) intercepts the GitHub approval event and requires a secondary, time-limited PIN before recording the signature. The result is a cryptographically bound record tying the signer's identity, intent, timestamp, and exact document revision into a single verifiable artefact attached to the GitHub Release.
Five profiles map common product types to the standards and SOPs that typically apply: AI-based diagnostic software (SaMD + AI), an app with AI features but no medical claim, a digital health / wellness app, in-house clinical software, and clinical-study support software. See the adoption guide.
The baseline is open source with split licensing: code, scripts, and automation are Apache-2.0; SOPs, work instructions, templates, and documentation are CC BY-SA 4.0. Forking and adopting the baseline is free; DearAuditor separately offers paid validation documentation packages (IQ/OQ/PQ) for regulated installations.
Mirror the public baseline into a controlled private repository, tailor it to your organisation, validate it for intended use, train your team, and approve it before use. A bootstrap script sets up the private repository: it derives code-owner review from your signer registry and copies the baseline's branch protection and merge rules.